topic Re: How to edit a props.conf for an aribitrary source? in Getting Data In

How to edit a props.conf for an aribitrary source?

minkyuk — Tue, 07 Jul 2015 13:34:34 GMT

Where do I go & how should I do it?

I know what to change,

[$sourcetype]
MAX_EVENT = 100000

I would appreciate your help,

A newcomer

Re: How to edit a props.conf for an aribitrary source?

solarboyz1 — Tue, 29 Sep 2020 06:36:44 GMT

props.conf can be found in a few places:

$SPLUNK_HOME/etc/system/default - Default props (do not modify)
$SPLUNK_HOME/etc/system/local - Should be used for adjustments that are only needed on THIS system
$SPLUNK_HOME/etc/apps/{APPNAME}/default - An apps default props.conf (do not modify)
$SPLUNK_HOME/etc/apps/{APPNAME}/local - Customization of an apps props.conf.

If there isn't a props.conf under the local directory, a new file should be created.

We use the following guidelines:

If the modification is to props.conf implemented by an App, it should be in that apps local/props.conf
If the modification is a standalone change, we put it in one of the Apps created for our environment that are then pushed using the deployment server

If you are looking for where the props.conf for a specific sourcetype are defined you can use the btool command:

For all props:
$SPLUNK_HOME/bin/splunk cmd btool --debug props list

For the props to a specific sourcetype:
$SPLUNK_HOME/bin/splunk cmd btool --debug props list $sourcetype

Re: How to edit a props.conf for an aribitrary source?

richgalloway — Tue, 07 Jul 2015 13:46:49 GMT

The file to edit is SPLUNK_HOME/etc/system/local/props.conf. If it doesn't exist, create one. DO NOT edit default/props.conf! Use the text editor of your choice to do the editing.

Re: How to edit a props.conf for an aribitrary source?

minkyuk — Tue, 07 Jul 2015 13:48:00 GMT

Do I put the line in a search head?

Re: How to edit a props.conf for an aribitrary source?

richgalloway — Tue, 07 Jul 2015 13:52:20 GMT

Put it on the indexer(s). Remember to restart Splunk after making the change.

Re: How to edit a props.conf for an aribitrary source?

minkyuk — Tue, 07 Jul 2015 14:00:05 GMT

Sorry, but do you mean at time of "Adding Data?"

Re: How to edit a props.conf for an aribitrary source?

minkyuk — Tue, 07 Jul 2015 14:02:15 GMT

like, index setting section?

Re: How to edit a props.conf for an aribitrary source?

richgalloway — Tue, 07 Jul 2015 14:04:08 GMT

Whenever you modify a .conf file outside the Splunk GUI, Splunk must be restarted to incorporate the change.